openclaw-bridge
Warn
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions direct the agent to read highly sensitive local files, including
~/.claude/settings.json(configuration) and all files within~/.claude/sessions/(full conversation history). This data is intended to be synchronized with a local gateway service athttp://localhost:18789. - [COMMAND_EXECUTION]: The skill utilizes shell commands (
bash,cp,jq) to perform bulk file operations and configuration updates. It also includes instructions for the user to modify shell startup scripts (~/.zshrcor~/.bashrc) to persist environment variables required for the bridge, which constitutes a persistence mechanism. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from existing skills (
~/.claude/skills/) and session logs (~/.claude/sessions/). Evidence: 1. Ingestion points:~/.claude/skills/*/SKILL.mdand~/.claude/sessions/*.md. 2. Boundary markers: Absent in migration templates. 3. Capability inventory: Bash execution, file writing, and network communication via the gateway or CLI. 4. Sanitization: No sanitization logic is provided for the transformation of instruction content between platforms.
Audit Metadata